{ "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.49514857, "rte": "az", "prob": 0.49514857 }, { "cls": 0, "raw": 0.49606073, "rte": "az/nupkg", "prob": 0.49606073 } ], "prob": 0.49514857, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.49514856934547424, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.013035714626312256, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.46166515350341797, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000041097402572631836, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0003479123115539551, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-11T19:19:31Z" }, "path": "Wei.Abp.Identity.Application.Contracts.4.3.5-beta.10.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MS\u003ev(S/kbv5$)W000Ym000xb003wDwO=Ave]\u003eJtBcI*wy63a7mC!pGa(}D\u0026gu@b4QL{i2Zkyq2]YjjkiS", "n": [ { "c": 1, "d": "APK has misplaced executables", "i": "objectives/anti-static/pack/archive::apk-misplaced-executable-members", "o": 0, "z": 41, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "O(Er)H(Po)", "sha": "97f42ec6d9d69ee72750fcda7c6fc94beac536d4650663d3de1833770197fbb8", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Wei.Abp.Identity.Application.Contracts/Wei.Abp.Identity.Application.Contracts.4.3.5-beta.10.nupkg", "risk": 3, "size": 35186, "type": "nupkg", "facts": { "metrics": { "file": { "size": 35186.0, "entropy": 7.92, "size_bytes": 35186.0 }, "binary": { "overall_entropy": 7.92, "peak_region_bytes": 31744.0, "peak_region_entropy": 7.79 }, "archive": { "file_count": 6.0, "member_count": 6.0, "script_count": 0.0, "zip_bomb_ratio": 3.03, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 34262.0, "compression.ratio": 0.45, "hidden_file_count": 2.0, "total_uncompressed": 76060.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 6.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 2.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25068.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.67, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 5.0 } } }, "ident": { "name": { "value": "Wei.Abp.Identity.Application.Contracts", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/thk-liu/Wei.Abp", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/thk-liu/Wei.Abp", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "刘志伟", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.3.5-beta.10", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Wei.Abp.Identity.Application.Contracts", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "objectives/evasion/anti-av/edr-detect/wmi::display-name-field", "mbc": "B0013", "conf": 0.8999999761581421, "crit": 3, "desc": "Security product displayName field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/user/query::dotnet-user-name", "atk": "T1033", "conf": 0.8999999761581421, "crit": 3, "desc": "Query current username via .NET", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 532.0, "entropy": 5.18, "size_bytes": 532.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 532.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Wei.Abp.Identity.Application.Contracts/Wei.Abp.Identity.Application.Contracts.4.3.5-beta.10.nupkg!!_rels/.rels", "pid": 0, "sha": "fee71658b01833ff09c788c6ff24c5e620a7e6d4b14587a3e22bd5465187b38e", "size": 532, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 45, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 43 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 120 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk4d]taz(4cB.\u003eRKfjXTnv@=p5BzkVhj]", "ln": 10, "addr": 431 }, { "b": "arR^HjAL1AB3wYwNb#8H\u003cH?bFNUk9UA3fswwQ5sWNUo*WSPyyIjtg!+xlcl", "ln": 11, "addr": 474 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dHxLPhox(#7gwOA+.vSiIlv@Dj3x((GZgbpQ{h!1N4wI=zbg+\u0026z[g?p2OwN^LNhdws2w[CHehzv9Ff/yZBa%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 527, "z": 71, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 523 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 649, "z": 715, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 645 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBu7%cb0C", "ln": 14, "addr": 665 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJs7M7#l1j^=nN#yIBzk\u0026xe\u003c%R{vqfQiq!PPWwN(#cC4CYnx(v(La#y]de\u0026tj\u0026wPRukf!:^]wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 15, "addr": 705 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1505.0, "entropy": 5.24, "size_bytes": 1505.0 }, "binary": { "overall_entropy": 5.24, "peak_region_bytes": 1505.0, "peak_region_entropy": 5.33 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Wei.Abp.Identity.Application.Contracts/Wei.Abp.Identity.Application.Contracts.4.3.5-beta.10.nupkg!!Wei.Abp.Identity.Application.Contracts.nuspec", "pid": 0, "risk": 1, "sha": "dd356695bb54f625d9fbbb22f5c0a580c281f6d1b54a3436f53acd1daf0a5f9a", "size": 1505, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 527, 71 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 649, 715 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 45 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?d", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000f-IaM00000nb@R\u00260SSx7nn[LeL-kUy0rr9100000M[FBtUS@f*000000000000000000000000000000000000000000000000009S*V?000cKa{4\u003c{0rr95dJOUr0SSi6dK1]@Ef6xG1s+C]DJKlF1s+O%1apmK00B+)0W[9I017g%0W[cJ017g%0^+7J00B+}0T0\u0026O000cK9S*V)000cKa{4\u003c{1][SadJOUr2lj-bdK1]@EfP-L1s+C]c\u003eVHW1$yU}c\u003cfII3mW7#c\u003coOJ3mW7#DK6PK1s+O%1apBP00B+)0^+jN00B+}0T0\u0026S000cK9S*V}000cKa{4\u003c{3ig5edJOUr3JHefdK1]@Eg32P1s+C]DKG(O1s+O%1apNT00B+)0^+vR00B+}0T0\u0026W000cK9S*V#000cKa{4\u003c{4GDFidJOUr4/=OjdK1]@EgDqT1s+C]DK{eS1s+O%1apZX00B+)0W[lM017g%0^+HV00B+}0T0\u0026.000cK9S*W3000cKa{4\u003c{5=.[mdJOUr6951ndK1]@Eg(OX1s+C]c\u003cG.L3mW7#DLuCW1s+O%1ap\u003c-00B+)0^+TZ00B+}0T0\u0026=000cK9S*W7000cKa{4\u003c{761sqdJOUr7xsBrdK1]@Ehq\u003e-1s+C]DL=..1s+O%1aq0^00B+)0^+^+00B+}0T0\u0026*000cK", "n": [ { "c": 1, "d": "No section reaches compression-grade entropy", "i": "metadata/binary/metrics/threshold::no-compression-grade-section", "o": 512, "z": 512, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "\u003eaEH[UzhkyQ34I(a$KfgarR^Hb2@X}A=SA=ar{0kSoe]Ba$KfgarR^Hb2@I%z!0MbiV]TgR\u003eT", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 5095, "z": 10, "cf": 1.0 } ], "ln": 5079 }, { "b": "\u003eB5%zY{m/:Zurhja$KfgarR^Hb2@X}A-lK\u003eBzkS9B0rT/biLh?\u003e7{IgUd\u003c8jT%bza3lQDlar\u003ci/B8U@7C(", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 7220, "z": 17, "cf": 1.0 } ], "ln": 7204 }, { "b": "(70p/RH^({U\u0026S0Na$KfgarR^Hb1cc^Abn%dpgn0JiZEN#z*b=6mSirxwP}c}wPz\u0026oiV]TdG[nD\u003cXAf{8\u003e9AmmL=i-2W\u003c0vj3lQDlar\u003ch", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 7608, "z": 35, "cf": 1.0 } ], "ln": 7592 }, { "b": "P%0QZQ#Yaw\u003c=C/[a$KfgarR^Hb2-5?wN/*ZB7Gxkb03?\u003c(41SMI(C)7Soe]Ba$KfgarR^Hb2-5?wN/*W", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 8685, "z": 16, "cf": 1.0 } ], "ln": 8669 }, { "b": "\u003eEVAgYnbNYLJFD\u0026a$KfgarR^Hb2z\u0026\u003eze16jx(v(Io\u003c}{FxjU7:wPz\u0026oiV]TfUa+3uHuB/1\u003e7{F\u003cedz}earR^Jp?sV:x(!s", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 9601, "z": 27, "cf": 1.0 } ], "ln": 9585 }, { "b": "zP5!5DbE7dwPR^2a$KfgarR^Hb2z\u0026\u003eze16jx(v(Io\u003c}{FxjU7:wPz\u0026oiV]RtB.\u003e(5zP5!\u0026-iBb!A(tj9DbE7dwPR^2a$KfgarR^Ha]", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 10639, "z": 33, "cf": 1.0 } ], "ln": 10623 }, { "b": "x\u003e[\u0026p.)TC]BzkPaa$KfgarR^Hb2@X}A=SA=ar\u003cE3y\u00260J$-iA*\u003cV20\u0026?a$KfgarR^Hb2@I%z!0MbiV]Rt", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 10802, "z": 16, "cf": 1.0 } ], "ln": 10786 }, { "b": "D2EZCzfo]xzGQm\u0026a$KfgarR^Hb2-5?wN/*ZB7Gxkb03?\u003colC5!vq:2*w5LS*vrfq\u003eaAIbiR!H2)edz}earR^Jq!k", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 12126, "z": 22, "cf": 1.0 } ], "ln": 12110 }, { "b": "BA}?paszH\u0026Ej4l6edz}earR^Jp*[A^Cw?Ijb03?\u003cp*[A^Cw?Ija$KfgarR^Hb2@X}AZTFPwPRT8zBntWw[=p5ve", "n": [ { "c": 1, "d": "Inline password token in lure", "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "o": 17352, "z": 21, "cf": 0.75 } ], "ln": 17336 }, { "b": "cQe^:3lQEt4gmH)3ig5alq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 21064, "z": 4, "cf": 1.0 } ], "ln": 21048 }, { "b": "02M500098b3nRU.0nv[{1PXQr2O^vv0ji7?0097m2O^vv02M500098b3nRU.0oT?+1PXQ8", "n": [ { "c": 1, "d": "SOCKS5 client greeting bytes", "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "o": 23307, "z": 8, "cf": 0.8999999761581421 } ], "ln": 23291 }, { "b": "0NzA!gJJPy6m.(W0NzB\u003e1P!V800Ju900@Sg01e=j01n\u0026s01F#x01P5G01YbL01/hP022tU", "n": [ { "c": 1, "d": "SOCKS5 BIND request opcode", "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "o": 34481, "z": 8, "cf": 0.6000000238418579 } ], "ln": 34465 }, { "b": "yHpBnvpK7!zF8BMwO+(SjxlDlA.f!.k5jIjlsBwtx(mMMx\u003eq9\u003e06B4$xjkW(Dsp]fz/eM)x(({SB3swDuQwghyIvW0", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 41508, "z": 24, "cf": 0.8799999952316284 } ], "ln": 41492 }, { "b": "zCBRSwDkkvz/{1]vqPMQxjVf(rDz.(pgn0J0cqZ[uSzeUA.Z4WwDl\u003c]wPyKOzdJYWwPRoTB-Hk=", "n": [ { "c": 3, "d": "Query current username via .NET", "i": "micro-behaviors/process/user/query::dotnet-user-name", "o": 42770, "z": 12, "cf": 0.8999999761581421 } ], "ln": 42754 }, { "b": "B7GD2l${ZYy*?P:vqPMQwnca7y*?P:vqPMQB-RbmzEEx[0b2\u003e+uSh8/zEEx[0cqZ[uSh8/zEEw", "n": [ { "c": 3, "d": "Security product displayName field", "i": "objectives/evasion/anti-av/edr-detect/wmi::display-name-field", "o": 42891, "z": 11, "cf": 0.8999999761581421 } ], "ln": 42875 }, { "b": "v{%E[z/df{z/fVqvpKz2e[w^m07QQxp?sV:x(!ufz/eu\u003epiyw?07QQxm@\u0026J\u003cA8gHH", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 44422, "z": 4, "cf": 0.6000000238418579 } ], "ln": 44406 }, { "b": "BzkVh0cqZ[uQngzx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9ZQy\u0026p{(vSi}$wOb:\u0026v@#B6zu9HAA=2JiB7]Mgl\u0026", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 44882, "z": 17, "cf": 0.949999988079071 } ], "ln": 44866 }, { "b": "BzkVhlVl\u003c:A:-E1B1R3we]2DCzu9:Hx!zXXA4TZ)wO#Q7BA]G8AbYScv{%E[z/df{zV", "n": [ { "c": 1, "d": "JSON file extension", "i": "metadata/file/extension/identity::json-extension", "o": 45148, "z": 5, "cf": 0.30000001192092896 } ], "ln": 45132 }, { "b": "wPv=6v@#Tf04}+\u003eBz(g1q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?S.wPRoSz!@#Rwod-(wPRoSz!@#Rwod--wPRoVB7Gw-wod-(wPRoVB7Gw-wod--wPRoPA+w/#x)Kifx(v(?zFsh:wod-(wPRoPA+t", "n": [ { "c": 1, "d": ".NET Diagnostics namespace token", "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "o": 46464, "z": 18, "cf": 0.6499999761581421 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 46507, "z": 11, "cf": 0.8799999952316284 } ], "ln": 46448 }, { "b": "e\u003c%R{vqfQiq!PPWwN)tmr+lq)x(v(Liw93sf!Ldhavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 52425, "z": 15, "cf": 0.8500000238418579 } ], "ln": 52409 }, { "b": "e\u003c%R{vqfQiq!PPWwN)tmr+lq)x(v(Lg+HNph7*Nlavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 56117, "z": 15, "cf": 0.8500000238418579 } ], "ln": 56101 }, { "b": "GtOuqu[b:MyDsw40rr91l][NYtVUGJe\u003cS@=tVUGJe\u003cS@=tY1y\u0026B.\u003eSgtUeEqzGGPmD0BAZx!zXXA4TZ)wO#Q7BA]G8AbYScv{%E[z/df{z/fVqvpKz2tYj7^tVbcHwNPT\u003etYaa{iw90\u003cs7M7#l1j^=nN#yIBzk\u0026xe\u003cTC}y?Wx/BzkVhe\u003c\u003cL{BAg/1BAo6NwmtKqni]0*huqg-Uo5tl6bs[8w:j4(hHOUu5v@b/6GD", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 57416, "z": 138, "cf": 0.5 } ], "ln": 57400 }, { "b": "00000uQF:Ll#lWlvqfPVzf6i9A+e/mwnD5Z00000%0mT/kMy=:000000000000000000000000", "n": [ { "c": 1, "d": "mscoree DLL string reference", "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "o": 57662, "z": 11, "cf": 0.949999988079071 } ], "ln": 57646 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 57856, "z": 5, "cf": 0.8999999761581421 } ], "ln": 57840 }, { "b": "0000000000001$YgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rri41onA", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 57950, "z": 15, "cf": 0.949999988079071 } ], "ln": 57934 }, { "b": "fAr{fvGn7Z001RK3JHhclJz38z2!zMwDlPFBo3vZ003BcvGpuEaollUzVBqFBPujTwDhYg001zE1onD5lJz38z2!IPve$fBC(QOtve$cAwDhYg000\u003cl/iYQ}004fxcJBeEmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372wDlAAe=XfqvGpuEe=XDywb{fvzua+Ux-JkPC(PC%k(+\u003c7z#:XOx-ISyve$xHx-J5Kzu8o?lJz38zua+UASxIFv/QPJA@Vgu001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WWce=W:ee=WN9004fxd/YOInDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372wDlAAe=XfqvGpuEe=XDy", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 58378, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 58218, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 58258, "z": 15, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 58426, "z": 12, "cf": 0.699999988079071 }, { "c": 1, "d": "PE version info numeric fields present", "i": "metadata/binary/anomaly/format::version-info-file-version-present", "o": 58404, "z": 7, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 58292, "z": 38, "cf": 0.949999988079071 }, { "c": 1, "d": "Short titlecase word-salad version strings", "i": "objectives/evasion/masquerade/version-resource/claim::short-titlecase-version-words", "o": 58170, "z": 8, "cf": 0.800000011920929 } ], "ln": 58154 }, { "b": "z#+d-ASx!Nx8(PBBn#pvaohxwEGg\u003e#0rt)}ASx!Nx8(SCzua8ByYD{8x-I@HwDlPFve$cAwDhYgr@=!ix-G:=k(+u]z#Y", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 58586, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 58576, "z": 1, "cf": 0.949999988079071 } ], "ln": 58560 }, { "b": "wb{ACyYBCn003)pcJBeEpYLIozVBqFBPt[KBo25ove$cAwDhYg00372wDlAAe=XfqvGpuEe=XDywb{fvzua+Ux-JkPC(PC%k(+\u003c7z#:XOx-ISyve$xHx-J5Kzu8o?lJz38zua+UASxIFv/QPJA@Vgu005eZhVJ\u003cUpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=WWce=W:eeDxkWwDh", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 58714, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 58826, "z": 14, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 58740, "z": 38, "cf": 0.949999988079071 } ], "ln": 58698 }, { "b": "hukAhh#\u0026{U001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WWc", "n": [ { "c": 1, "d": "Short titlecase word-salad version strings", "i": "objectives/evasion/masquerade/version-resource/claim::short-titlecase-version-words", "o": 58974, "z": 8, "cf": 0.800000011920929 } ], "ln": 58958 }, { "b": "000000000000000000000pP%*3\u0026*ncp^j{W000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 59392, "z": 6, "cf": 0.8999999761581421 } ], "ln": 59376 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 57344, 5.95, "r-x" ], [ ".rsrc", 57856, 1536, 2.7, "r--" ], [ ".reloc", 59392, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 125235.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.38, "clr.managed_resource_count": 3.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 5661.0, "version.identity_symbol_ratio": 0.1, "clr.managed_resource_max_entropy": 5.85 }, "file": { "size": 59904.0, "entropy": 5.85, "size_bytes": 59904.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.95, "string_count": 919.0, "overall_entropy": 5.85, "entropy_variance": 5.76, "avg_string_length": 26.21, "max_string_length": 401.0, "peak_region_bytes": 8192.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.84, "string_length_stddev": 21.72, "largest_section_ratio": 0.96, "sentence_string_count": 128.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 57344.0, "entropy_max": 5.95, "entropy_mean": 2.91, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Er)H(Po)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Wei.Abp.Identity.Application.Contracts/Wei.Abp.Identity.Application.Contracts.4.3.5-beta.10.nupkg!!lib/net9.0/Wei.Abp.Identity.Application.Contracts.dll", "pid": 0, "risk": 3, "sha": "5f735e72e933471b164ee859408f7514bc1ecb9b62c6a7921131bccdf43fb834", "size": 59904, "traits": [ { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 21064, 4 ] ] }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 57416, 138 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 58826, 14 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 44422, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 58378, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/evasion/anti-av/edr-detect/wmi::display-name-field", "mbc": "B0013", "conf": 0.8999999761581421, "crit": 3, "desc": "Security product displayName field", "spans": [ [ 42891, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 57950, 15 ] ] }, { "id": "micro-behaviors/process/user/query::dotnet-user-name", "atk": "T1033", "conf": 0.8999999761581421, "crit": 3, "desc": "Query current username via .NET", "spans": [ [ 42770, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 21064, 4 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 465, "entropy": 4.87 }, "binary": { "peak_region_bytes": 465, "peak_region_entropy": 4.87 } } }, "id": 4, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Wei.Abp.Identity.Application.Contracts/Wei.Abp.Identity.Application.Contracts.4.3.5-beta.10.nupkg!![Content_Types].xml", "pid": 0, "risk": 1, "sha": "a5996b3a6ef9347901c74177578657d6d189531c61bc6bbe78a00d2c77af6f3a", "size": 465, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 2, "desc": "Text, document, or config extension" } ], "type": "xml" }, { "id": 5, "sha": "1adb67d928b2431cee7e903365bddb780d37947ea3e11bd30e1a9dfcbc611129", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Wei.Abp.Identity.Application.Contracts/Wei.Abp.Identity.Application.Contracts.4.3.5-beta.10.nupkg!!package/services/metadata/core-properties/11f6cd6ddce74d359c11c78501d23e1f.psmdcp", "size": 672, "type": "xml", "depth": 1 }, { "id": 6, "mol": "Md", "sha": "c700496e76a837c814a4bff43984b086c0416fa5c7984d1270f5dc7f4da4e33f", "path": "Wei.Abp.Identity.Application.Contracts@4.3.5-beta.10.registry.json", "risk": 1, "size": 905, "type": "registry", "depth": 1 } ], "omitted_files": 2, "rev": "2fc08", "v": "8" } }